Live › vulnerability › CVE-2026-120642
Versions of the Perl CGI module before 5.00 return some request-derived values, such as upload filenames, cookie names and path info, without the taint flag under Perl's taint mode. Code that relies on taint mode to catch unvalidated input can therefore treat attacker-supplied data as safe.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that run Perl CGI scripts under taint mode and depend on it to validate request data. Systems that do not use the CGI module, or that do not run under taint mode, are less exposed; the sources do not say how far the exposure reaches.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'-T (taint mode) that use CGI.pm for uploads, cookies or path info5.00 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.
The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on.
These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.
This page as .md · .json · in your agent: get_signal("CVE-2026-120642")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.